Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Completes the implementation of the encryptClientServer parameter . #4337

Conversation

corentin-soriano
Copy link
Contributor

@corentin-soriano corentin-soriano commented Sep 18, 2024

It is very useful to be able to disable client/server communication encryption for debugging or using an application firewall.
The encryptClientServer parameter was already present in the tp.config.php, and the JavaScript part was already prepared.

It should be noted that the encryption seems unnecessary since it is symmetric, and the key is present throughout all communications:

  • Anyone with a tool like Wireshark can read the encrypted content as well as the private key in the same request.
  • It significantly slows down the application: Teampass is much more responsive without this encryption.
  • An administrator concerned about the security of exchanges will systematically use TLS.

During my tests I noticed that the stripHtml function is vulnerable to XSS injection since it creates unsafe elements in the DOM.
As there was no consistency in using it, I removed its call and definition.

@nilsteampassnet nilsteampassnet merged commit be46e4b into nilsteampassnet:master Sep 20, 2024
2 of 3 checks passed
nilsteampassnet added a commit that referenced this pull request Sep 20, 2024
@corentin-soriano corentin-soriano deleted the disable_encryption_parameter branch September 24, 2024 06:16
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants